Why the United States Still Has No General Privacy Law

Gerald Ford signed the Privacy Act on the last day of 1974, December 31, a few months after Richard Nixon had left the White House by helicopter. The timing was not an accident. Over the previous two years, Americans had learned that their government kept files on its critics, that the White House had an enemies list, and that federal agencies had been turned against political opponents. The new law told every federal agency what it could collect about a person, how it had to keep those records, and how people could see and correct their own files. It was a real achievement. It was also, from the first day, half a law. It said nothing at all about the private companies that were already building databases of their own, and more than half a century later, Congress has never filled that gap.

In short: The Privacy Act of 1974 protected Americans from federal record-keeping but deliberately left private companies alone. Since then, the U.S. has relied on narrow laws for specific kinds of data and on the states, while broad federal bills keep dying over two questions: whether a national law should override state laws, and whether people may sue. Here's the case that those two questions can be answered.

A law built for a different threat

To understand why the Privacy Act stopped where it did, look at what frightened people in 1974. The picture was a government computer, a mainframe holding files on millions of citizens, used by officials who answered to a President willing to misuse it. A federal advisory committee at the Department of Health, Education, and Welfare had published a report in 1973 called Records, Computers and the Rights of Citizens. It proposed a short list of principles: no secret record systems, a way for people to learn what is in their file, a way to stop information gathered for one purpose from being used for another without consent, a way to correct errors, and a duty on the organization holding the data to keep it reliable and safe.

Those principles, often called fair information practices, became the backbone of privacy law around the world. Congress applied them to federal agencies through the Privacy Act. Lawmakers knew the private sector raised similar questions, and the Act created a study commission to look at them. That commission reported in 1977 and recommended steps for private record-keeping. Congress did not adopt them as a general rule. The moment had passed. Watergate was over, and the private databases of the 1970s, at credit bureaus, insurers and banks, seemed manageable one industry at a time.

Privacy by the slice

That choice, to regulate one sector at a time, defined the next fifty years. Congress had already passed the Fair Credit Reporting Act in 1970, giving people rights over credit reports. In 1974, the same year as the Privacy Act, it passed a law protecting student education records. Over the following decades came a law for video rental records in 1988, a law for health information in 1996, a law protecting children online in 1998 and privacy rules for financial institutions in 1999.

The video law has the best origin story. In 1987, during the fight over Robert Bork's nomination to the Supreme Court, a Washington newspaper published a list of movies his family had rented. The list was dull. But members of Congress, imagining their own rental histories in print, passed the Video Privacy Protection Act the next year. It still protects what you watch more strongly than federal law protects your location, your browsing or your purchases.

Each of these laws was written for a problem in front of lawmakers at the time. None of them covers the business model that came later, in which apps, websites, data brokers and advertising networks gather information about almost everyone and trade it. A fitness app is usually not covered by the health privacy law, because that law applies to doctors, insurers and their contractors, not to every company that touches health data. A data broker that buys location records from apps faces few federal limits on resale.

Who enforces what exists

In the absence of a general law, the main federal referee has been the Federal Trade Commission. Its authority comes from a 1914 statute against unfair or deceptive practices. When a company breaks its own privacy promises, the FTC can call that deception. When a practice causes harm consumers cannot avoid, the agency can sometimes call it unfair. Many consent orders against tech companies rest on these broad words.

That is a thin reed. The FTC generally cannot fine a company for a first violation of the core law; penalties usually come only after a company breaks an existing order. It has to prove each case. And its independence is now in question. In Trump v. Slaughter, decided June 29, 2026, the Supreme Court held that the for-cause protection shielding FTC commissioners from removal is unconstitutional. A commission whose members serve at the President's pleasure may enforce privacy aggressively or not at all, depending on who sits in the White House. For a country whose main privacy protection is an agency, that is a large change.

The states moved first

When Washington stalls, states act. California passed the California Consumer Privacy Act in 2018, after a wealthy real estate developer named Alastair Mactaggart qualified a privacy measure for the ballot and lawmakers wrote a law to persuade him to withdraw it. Voters later strengthened the law with a 2020 ballot measure that created a state privacy agency. Other states followed with their own comprehensive laws, and the number has grown to well over a dozen. Most give residents rights to see, delete and correct data and to opt out of having it sold or used for targeted advertising. Some cover sensitive categories, such as health and precise location, more strictly.

Europe had set the global benchmark in May 2018, when the General Data Protection Regulation took effect across the European Union. It requires a legal basis for processing personal data, gives people strong rights and lets regulators impose very large fines. American companies that operate in Europe already comply with it there, which undercuts the argument that comprehensive rules are impossible to follow.

The state laws differ, though, and that is where the federal fight begins.

The two questions that keep killing the bill

Congress came closest in 2022. The American Data Privacy and Protection Act, a bipartisan bill, cleared the House Energy and Commerce Committee by a vote of 53 to 2 that July. It would have set national rules on data minimization, limited targeted advertising to minors and created a way for individuals to sue. It never reached the House floor. In 2024, the chairs of the House and Senate commerce committees, Republican Cathy McMorris Rodgers and Democrat Maria Cantwell, released a new draft called the American Privacy Rights Act. It too stalled.

The obstacles were the same both times.

The first is preemption: whether a federal law should override state privacy laws. Industry wants a single national standard, which means wiping out stronger state rules. California's officials and many privacy advocates oppose any federal law weaker than what their states have, and in 2022 California's delegation fought the bill partly for that reason. Members from states without laws see less at stake.

The second is the private right of action: whether an ordinary person can sue a company for violating the law, or whether enforcement belongs only to regulators. Advocates say regulators will never have the staff to police an entire economy, and that lawsuits make rights real. Business groups say private suits invite a flood of litigation over technical violations.

There are other disputes, about how to treat small businesses, what counts as sensitive data and how far rules on algorithms should reach. But preemption and private suits are the ones that have broken coalitions.

The fair case for waiting, and why it falls short

The other side's argument deserves a hearing. A badly drafted federal law could lock in rules that age poorly, as the sector laws did. A law that bans too much data use could hurt small businesses that rely on cheap advertising, or entrench the largest platforms, which can afford compliance teams that startups cannot. Some Republicans also argue that a strong federal privacy regulator is one more agency with power over speech and commerce. And some privacy advocates themselves have argued that a weak federal law would be worse than none, because it would erase stronger state protections.

Those concerns are real. They are also reasons to write the law carefully, not reasons to have none. The current arrangement is not neutral. It means the default rule for most personal data in America is that companies may collect it, keep it and sell it unless a narrow statute or a state law says otherwise. Every year without a law is a year that default stays in place.

On the two hard questions, there are workable middle paths, and here I'm arguing for them. A federal law could set a strong floor and let states go further in defined areas, the approach Congress has taken with some other consumer protections. Private suits could be limited to serious violations, with a chance for companies to fix problems first, while still letting individuals enforce their rights when regulators do not. Neither side gets everything, which is what a law that passes looks like.

What a general law would change on an ordinary day

Abstractions make privacy easy to ignore, so consider a single afternoon. You check the weather on a free app, order a prescription refill, browse for a used car and drive to a clinic across town. Under current federal law, the weather app may share your precise location with advertising partners, who may pass it to data brokers. The car website may track you across other sites. Your pharmacy is covered by health privacy rules, but the period-tracking or fitness app on the same phone usually is not. Whether any of this can be stopped depends mostly on which state you live in and what you clicked when you installed each app.

A general law would change the default. The bipartisan bills of recent years shared a few core ideas, and they are worth spelling out because they are more modest than critics suggest.

Collect what you need. The central idea, often called data minimization, says a company may collect and use personal data only as reasonably necessary to provide the service a person asked for, plus a list of permitted purposes such as security and fraud prevention. A flashlight app would have no business collecting location.

Extra care for sensitive data. Health information, precise location, biometrics and data about children would get stronger protection, often requiring a person's affirmative consent before it could be transferred to anyone else.

Rights people can use. People could see what a company holds about them, correct it, delete it and take it elsewhere, and opt out of targeted advertising, through a process simpler than reading a forty-page policy.

Rules for brokers. Companies whose business is buying and selling data about people they have no relationship with would have to register and honor deletion requests.

None of this ends advertising or bans apps. It shifts the burden. Today, people must discover and resist data practices one company at a time. Under a general law, the company would need a reason to collect in the first place.

Why this is a progressive issue, not a niche one

It is tempting to treat privacy as a concern for technologists. It is not. Data about people is used to set prices, screen tenants, decide who sees a job ad, track people seeking reproductive care across state lines and locate immigrants. The people with the least power usually have the least ability to protect themselves: they cannot afford privacy tools, and they are more likely to be in a database that leads to a denied apartment or an immigration arrest.

The Privacy Act itself shows the stakes, because the federal government's data on its own citizens is again a live question. In 2025, a new White House office with broad access to agency data systems set off a wave of lawsuits arguing that sharing those records violated the 1974 law. Whatever courts finally decide in those cases, the episode showed that the old law still matters and that its protections depend on officials willing to follow them.

What you can do

Privacy law moves slowly until it suddenly moves, often when a new Congress sets its agenda. A few ways to push:

1. Contact the people who will write the next bill. The representatives lookup turns a home address into names: your House member, both senators and your state lawmakers, plus phone numbers, contact forms and recent votes for each. Ask your senators and representative whether they support a federal privacy law, and where they stand on preemption and on letting people sue.
2. Push your state, too. Most of the progress has been at the state level, and your state legislators can act faster than Congress. The same lookup gives you their contact details.
3. Comment on federal data rules. When the FTC, the Consumer Financial Protection Bureau or other agencies propose rules about data brokers or surveillance, they appear among the rules open for public comment, sorted by closing date and grouped by issue, with guidance on writing a comment that counts.
4. Follow the debate. The tech and AI topic page gathers reporting on privacy bills, data brokers and enforcement, so you can see when the fight comes back.
5. Support groups doing the work. The organizations directory lists nonprofits by cause in every state, including civil rights and legal aid groups that defend people harmed by data misuse.